align: 修正技能播种路径：codex-home/skills/ 才是用户技能目录

2026-10-30 主机实测（临时 codex-home，生产未动）纠正：
先播 .agents/skills/ 时 skills/list 只返回 5 个系统技能，
3 个自有技能一个没出现；改播 skills/ 后返回 8 个，
3 个自有技能以 scope=user 出现。系统技能本身就在
skills/.system/ 下。
- skill_seed DEST_SUBDIR 由 .agents/skills 改为 skills，
  模块文档与 worker 注释同步修正。
- 测试期望路径同步改为 skills/。
- 对照表补实测结论与附带发现：Codex 自带系统技能
  imagegen，图片生成在 Codex 本体里不是无技能。

验证：skill_seed + chatgpt skills + websearch worker
共 14 项全过。主机探针文件已全部清理，生产未动。

cloud/skill_seed.py

@@ -4,16 +4,22 @@ Mirrors the websearch MCP seeding pattern in cloud/websearch.py,
 but for skills, not MCP config:
 
 - Source is cloud/skills/<name>/SKILL.md (the batch-1 skill pack).
-- Destination is <codex-home>/.agents/skills/<name>/SKILL.md.
-  Why this path: Codex documents personal skills at
-  $HOME/.agents/skills and project skills at .agents/skills
-  (scanned from the working directory up to the repo root).
-  A Docker tenant task must not pollute its task repo/worktree
-  (seeding into the worktree would show up in the task diff),
-  so the tenant codex-home -- the per-project persistent home
-  that is mounted into the container at
-  /var/lib/codex-app-server/codex-home -- is the personal-level
-  analogue. This is the same channel websearch MCP seeding uses.
+- Destination is <codex-home>/skills/<name>/SKILL.md.
+  Why this path: verified live on 2026-10-30 with the real
+  Codex binary (host.py skills-list against a temp codex-home
+  on the production host, production untouched). The first
+  attempt -- <codex-home>/.agents/skills/ -- was NOT discovered
+  (skills/list returned only the 5 system skills). Copying the
+  same SKILL.md files to <codex-home>/skills/ made them appear
+  as scope=user (5 system + 3 ours, count 8). System skills
+  themselves live at <codex-home>/skills/.system/, which is
+  the tell that this is the user-skills directory for a
+  CODEX_HOME. A Docker tenant task must not pollute its task
+  repo/worktree (seeding into the worktree would show up in
+  the task diff), so the tenant codex-home -- the per-project
+  persistent home that is mounted into the container at
+  /var/lib/codex-app-server/codex-home -- is the right channel.
+  This is the same channel websearch MCP seeding uses.
 - Idempotent and non-destructive by design:
   - a missing destination file is copied;
   - an identical destination file is left alone;
@@ -24,16 +30,16 @@ but for skills, not MCP config:
 - No config.toml change, no key, no network: skills are plain
   instruction files, and the helper never writes secrets.
 
-Honest boundary (see docs/chatgpt-codex-alignment.md): the
-destination path follows the documented personal-skills pattern
-mapped onto the tenant home. Whether a given Codex build picks
-these skills up in a Docker tenant task still needs a live
-verification task (skills/list + an explicit $live-info call),
-the same kind of e2e probe websearch MCP got after its seeding
-PR. Until that probe passes, do not claim the skills are live
-in production tasks -- this helper only guarantees the files
-land in the tenant home, idempotently, without clobbering
-tenant edits.
+Honest boundary (see docs/chatgpt-codex-alignment.md): discovery
+itself is now live-verified (skills/list, scope=user, on a temp
+home with the real Codex binary). What is NOT yet verified is
+model invocation inside a real Docker tenant task (an explicit
+$live-info call that actually runs and returns a result, and
+whether the relay model honours it). Until a task-level probe
+passes, do not claim the skills are live in production tasks --
+this helper only guarantees the files land in the tenant home,
+idempotently, without clobbering tenant edits, and that
+skills/list sees them there.
 """
 
 import os
@@ -42,8 +48,9 @@ from pathlib import Path
 
 # cloud/skills/<name>/SKILL.md, next to this module.
 SKILLS_DIR = Path(__file__).resolve().parent / "skills"
-# Personal-level skills inside a codex-home.
-DEST_SUBDIR = Path(".agents") / "skills"
+# User-level skills inside a codex-home (live-verified 2026-10-30:
+# .agents/skills inside a codex-home is NOT discovered).
+DEST_SUBDIR = Path("skills")
 
 
 def skill_source_dir(skills_dir=None):

cloud/tests/test_skill_seed_worker.py

@@ -56,7 +56,7 @@ class SkillSeedHelperTestCase(unittest.TestCase):
         home = os.path.join(self.tmp.name, "home")
         src = self._src()
         ensure_codex_home_skills(home, src)
-        dest = os.path.join(home, ".agents", "skills",
+        dest = os.path.join(home, "skills",
                             "live-info", "SKILL.md")
         open(dest, "w").write("tenant edited version\n")
         out = ensure_codex_home_skills(home, src)
@@ -98,7 +98,7 @@ class WorkerSkillSeedTestCase(unittest.TestCase):
         return Worker(self.db_path, "/fake/host.py", **kwargs)
 
     def _skill_path(self, dirs, name):
-        return os.path.join(dirs["codex_home"], ".agents", "skills",
+        return os.path.join(dirs["codex_home"], "skills",
                             name, "SKILL.md")
 
     def test_flag_off_is_old_behaviour(self):
@@ -106,7 +106,7 @@ class WorkerSkillSeedTestCase(unittest.TestCase):
         self.assertFalse(worker.seed_skills)
         dirs = worker._tenant_dirs("projA")
         self.assertFalse(os.path.exists(
-            os.path.join(dirs["codex_home"], ".agents", "skills")))
+            os.path.join(dirs["codex_home"], "skills")))
 
     def test_flag_on_seeds_real_pack(self):
         worker = self._worker(seed_skills=True)

cloud/worker.py

@@ -570,7 +570,7 @@ class Worker:
         # config.toml + 可选的 websearch MCP）。开启后
         # _tenant_dirs 在 websearch 播种之后调用 skill_seed
         # 的播种助手，把 cloud/skills/ 的 SKILL.md 拷进租户
-        # codex-home/.agents/skills/（个人级技能路径，见
+        # codex-home/skills/（用户级技能路径，实测见
         # skill_seed.py 的路径说明）。老租户下一次任务自动
         # 合并；租户改过的技能文件绝不覆盖，只上报 differs。
         self.seed_skills = bool(seed_skills)
@@ -5702,7 +5702,7 @@ def main(argv=None):
     parser.add_argument("--seed-skills", action="store_true",
                         help="租户 codex-home 自动播种对齐技能包："
                              "_tenant_dirs 把 cloud/skills/ 的 SKILL.md"
-                             " 拷进租户 codex-home/.agents/skills/；"
+                             " 拷进租户 codex-home/skills/；"
                              "默认关，老租户不受影响；租户改过的"
                              "技能文件绝不覆盖")
     parser.add_argument("--task-timeout", type=float, default=1800,